@1claw/cli 0.36.6 → 0.37.1

package/dist/src/lib/paths.js

@@ -1,6 +1,7 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { existsSync } from "node:fs";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 // Resolves bundled, non-TypeScript assets (Docker base context + module
 // manifests) both when running from compiled `dist/` and from `src/` in dev.
 //
@@ -8,6 +9,7 @@ import { existsSync } from "node:fs";
 // `dist/src/`, alongside the copied `docker/` and `modules/` asset trees.
 const here = dirname(fileURLToPath(import.meta.url));
 const srcRoot = join(here, "..");
+const CONFIG_DIR = process.env.ONECLAW_CONFIG_DIR || join(homedir(), ".config", "1claw");
 /** Directory containing the base Docker build context. */
 export function dockerBaseContext() {
     return join(srcRoot, "docker", "base");
@@ -32,6 +34,45 @@ export function moduleDir(name) {
 export function deployTemplateDir(provider) {
     return join(srcRoot, "deploy", provider);
 }
+/** Local cache directory for fetched templates. */
+export function templatesCacheDir() {
+    return join(CONFIG_DIR, "templates");
+}
+/**
+ * Directory containing bundled templates from the agent-templates submodule.
+ * Returns null if templates are not shipped with this CLI build.
+ *
+ * Search order:
+ *   1. dist/bundled-templates/templates (npm publish / monorepo build)
+ *   2. packages/agent-templates/templates (monorepo dev, submodule checkout)
+ *   3. dist/src/templates/ (legacy builds — only if template.yaml dirs exist)
+ */
+export function bundledTemplatesDir() {
+    // dist/bundled-templates/templates (srcRoot = dist/src → .. = dist)
+    const fromDist = join(srcRoot, "..", "bundled-templates", "templates");
+    if (dirHasTemplateManifests(fromDist))
+        return fromDist;
+    // Monorepo: packages/cli/dist/src/lib → ../../../agent-templates/templates
+    const monoRepo = join(srcRoot, "..", "..", "..", "agent-templates", "templates");
+    if (dirHasTemplateManifests(monoRepo))
+        return monoRepo;
+    // Legacy: templates copied into dist/src/templates/ (conflicts with compiled TS)
+    const legacy = join(srcRoot, "templates");
+    if (dirHasTemplateManifests(legacy))
+        return legacy;
+    return null;
+}
+function dirHasTemplateManifests(root) {
+    if (!existsSync(root))
+        return false;
+    try {
+        return readdirSync(root).some((d) => statSync(join(root, d)).isDirectory() &&
+            existsSync(join(root, d, "template.yaml")));
+    }
+    catch {
+        return false;
+    }
+}
 export function assetExists(path) {
     return existsSync(path);
 }

package/dist/src/lib/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/lib/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,mEAAmE;AACnE,0EAA0E;AAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAEjC,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,mBAAmB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/lib/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,mEAAmE;AACnE,0EAA0E;AAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,MAAM,UAAU,GACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1E,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,mBAAmB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB;IAC7B,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB;IAC/B,oEAAoE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,CACjB,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,iBAAiB,EACjB,WAAW,CACd,CAAC;IACF,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,iFAAiF;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,uBAAuB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEnD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACF,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YACrC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC,CACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACpC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/src/lib/provisioning.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared provisioning and daemon lifecycle helpers used by both `init` and
+ * `spawn` commands. Extracted from init.ts to avoid duplication.
+ */
+import { type SecretPolicy } from "../local-policy.js";
+export interface ProvisionResult {
+    agentId: string;
+    apiKey: string;
+    vaultId: string;
+    vaultName: string;
+}
+export interface StoreKeySpec {
+    path: string;
+    value?: string;
+    type?: string;
+    policy: SecretPolicy;
+}
+export declare function provisionCloudResources(containerName: string): Promise<ProvisionResult>;
+export declare function resolvePassphrase(confirm: boolean): Promise<string>;
+export declare function ensureDaemonRunning(opts: {
+    storeKeys?: StoreKeySpec[];
+}): Promise<string>;
+export declare function defaultModelForProvider(provider: string): string;
+/**
+ * Ensure the user is authenticated. Prompts for login if needed.
+ * Returns true if authenticated, false if the user declined.
+ */
+export declare function ensureAuth(): Promise<boolean>;
+export declare function waitForHealthy(port: number, endpoint?: string, timeoutMs?: number): Promise<boolean>;
+//# sourceMappingURL=provisioning.d.ts.map

package/dist/src/lib/provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../../src/lib/provisioning.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,OAAO,EAIH,KAAK,YAAY,EACpB,MAAM,oBAAoB,CAAC;AAS5B,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;CACxB;AAED,wBAAsB,uBAAuB,CACzC,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,eAAe,CAAC,CAkF1B;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BzE;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC5C,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,MAAM,CAAC,CA0FlB;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAahE;AAED;;;GAGG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAgBnD;AAED,wBAAsB,cAAc,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,SAAY,EACpB,SAAS,SAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/src/lib/provisioning.js

@@ -0,0 +1,256 @@
+/**
+ * Shared provisioning and daemon lifecycle helpers used by both `init` and
+ * `spawn` commands. Extracted from init.ts to avoid duplication.
+ */
+import ora from "ora";
+import inquirer from "inquirer";
+import { api } from "../client.js";
+import { getToken } from "../config.js";
+import { loginWithDevice } from "../auth.js";
+import { printInfo } from "../output.js";
+import { vaultExists, createVault, loadVault, saveVault, addSecret, getSecret, } from "../local-vault.js";
+import { loadPolicy, savePolicy, setSecretPolicy, } from "../local-policy.js";
+import { daemonSocketPath, daemonHealthy, startDaemonDetached, stopDaemon, } from "./daemon-control.js";
+import { sanitizeName } from "./container-config.js";
+export async function provisionCloudResources(containerName) {
+    const sid = sanitizeName(containerName);
+    const agentSpinner = ora("Provisioning agent...").start();
+    let agentId;
+    let apiKey;
+    try {
+        const res = await api("/agents", {
+            method: "POST",
+            body: {
+                name: `docker-agent-${sid}`.slice(0, 60),
+                description: "Created by `1claw init --docker`",
+                shroud_enabled: true,
+                intents_api_enabled: true,
+                auth_method: "api_key",
+            },
+        });
+        agentId = "agent" in res ? res.agent.id : res.id;
+        if (!res.api_key) {
+            agentSpinner.fail("Agent created but no API key returned.");
+            throw new Error("No agent API key returned by the API.");
+        }
+        apiKey = res.api_key;
+        agentSpinner.succeed(`Agent provisioned (${agentId.slice(0, 8)}…)`);
+    }
+    catch (err) {
+        agentSpinner.fail("Failed to provision agent.");
+        throw err;
+    }
+    const vaultSpinner = ora("Creating vault...").start();
+    let vaultId;
+    let vaultName;
+    try {
+        const vault = await api("/vaults", {
+            method: "POST",
+            body: {
+                name: `docker-vault-${sid}`.slice(0, 60),
+                description: "Created by `1claw init --docker`",
+            },
+        });
+        vaultId = vault.id;
+        vaultName = vault.name;
+        vaultSpinner.succeed(`Vault created (${vaultName})`);
+    }
+    catch (err) {
+        vaultSpinner.fail("Failed to create vault.");
+        throw err;
+    }
+    const policySpinner = ora("Binding vault and granting read policy...").start();
+    try {
+        await api(`/agents/${agentId}`, {
+            method: "PATCH",
+            body: { vault_ids: [vaultId] },
+        });
+        await api(`/vaults/${vaultId}/policies`, {
+            method: "POST",
+            body: {
+                principal_type: "agent",
+                principal_id: agentId,
+                secret_path_pattern: "secrets/*",
+                permissions: ["read"],
+            },
+        });
+        await api(`/vaults/${vaultId}/policies`, {
+            method: "POST",
+            body: {
+                principal_type: "agent",
+                principal_id: agentId,
+                secret_path_pattern: "providers/*",
+                permissions: ["read"],
+            },
+        });
+        policySpinner.succeed("Vault bound; read policies on secrets/* and providers/* granted.");
+    }
+    catch (err) {
+        policySpinner.fail("Failed to bind vault / create policy.");
+        throw err;
+    }
+    return { agentId, apiKey, vaultId, vaultName };
+}
+export async function resolvePassphrase(confirm) {
+    if (process.env.ONECLAW_VAULT_PASSPHRASE) {
+        return process.env.ONECLAW_VAULT_PASSPHRASE;
+    }
+    const { passphrase } = await inquirer.prompt([
+        {
+            type: "password",
+            name: "passphrase",
+            message: "Local vault passphrase:",
+            mask: "*",
+            validate: (v) => v.length >= 8 ? true : "Passphrase must be at least 8 characters",
+        },
+    ]);
+    if (confirm) {
+        const { confirmed } = await inquirer.prompt([
+            {
+                type: "password",
+                name: "confirmed",
+                message: "Confirm passphrase:",
+                mask: "*",
+            },
+        ]);
+        if (passphrase !== confirmed) {
+            throw new Error("Passphrases do not match.");
+        }
+    }
+    return passphrase;
+}
+export async function ensureDaemonRunning(opts) {
+    const socketPath = daemonSocketPath();
+    const alreadyRunning = await daemonHealthy(socketPath);
+    const storeKeys = opts.storeKeys ?? [];
+    const needVaultWrite = storeKeys.length > 0;
+    const needStart = !alreadyRunning;
+    const needReload = needVaultWrite && alreadyRunning;
+    if (!needVaultWrite && !needStart) {
+        return socketPath;
+    }
+    const creatingVault = !vaultExists();
+    let passphrase;
+    if (creatingVault) {
+        printInfo("No local vault found — creating one for the daemon.");
+        passphrase = await resolvePassphrase(true);
+        createVault(passphrase);
+    }
+    else {
+        passphrase = await resolvePassphrase(false);
+        try {
+            loadVault(passphrase);
+        }
+        catch {
+            throw new Error("Wrong passphrase for the existing local vault.\n" +
+                "  • If you mistyped it, re-run and enter the correct passphrase.\n" +
+                "  • If you've forgotten it, reset the vault with: 1claw local destroy --force\n" +
+                "    (this permanently deletes the old local vault and its secrets), then re-run.");
+        }
+    }
+    if (needVaultWrite && passphrase) {
+        let vault;
+        try {
+            vault = loadVault(passphrase);
+        }
+        catch {
+            throw new Error("Wrong passphrase or corrupted local vault.");
+        }
+        const policy = loadPolicy();
+        for (const spec of storeKeys) {
+            if (spec.value !== undefined) {
+                addSecret(vault, spec.path, spec.value, spec.type ?? "api_key");
+            }
+            else if (!getSecret(vault, spec.path)) {
+                throw new Error(`Provider key secret "${spec.path}" not found in the local vault.\n` +
+                    `  Add it first:  1claw local add ${spec.path}`);
+            }
+            setSecretPolicy(policy, spec.path, spec.policy);
+        }
+        saveVault(vault, passphrase);
+        savePolicy(policy);
+    }
+    if (needReload) {
+        const spinner = ora("Reloading daemon to pick up new secrets...").start();
+        await stopDaemon(socketPath);
+        const ok = await startDaemonDetached(passphrase, socketPath);
+        if (!ok) {
+            spinner.fail("Daemon did not come back up.");
+            throw new Error("Failed to reload the daemon.\n" +
+                "  • Check status:  1claw daemon status\n" +
+                "  • Start it manually (shows errors):  1claw daemon start");
+        }
+        spinner.succeed(`Daemon reloaded on ${socketPath}`);
+    }
+    else if (needStart) {
+        if (!passphrase)
+            passphrase = await resolvePassphrase(false);
+        const spinner = ora("Starting local daemon...").start();
+        const ok = await startDaemonDetached(passphrase, socketPath);
+        if (!ok) {
+            spinner.fail("Daemon did not become ready in time.");
+            throw new Error("Failed to start the daemon.\n" +
+                "  • Check status:  1claw daemon status\n" +
+                "  • Start it manually (shows errors):  1claw daemon start\n" +
+                "  • Stop a stuck daemon:  1claw daemon stop\n" +
+                "  • Forgot the vault passphrase? Reset it:  1claw local destroy --force");
+        }
+        spinner.succeed(`Daemon running on ${socketPath}`);
+    }
+    else {
+        printInfo(`Reusing running daemon at ${socketPath}`);
+    }
+    return socketPath;
+}
+export function defaultModelForProvider(provider) {
+    switch (provider.toLowerCase()) {
+        case "anthropic":
+            return "claude-3-5-haiku-latest";
+        case "google":
+        case "gemini":
+            return "gemini-2.5-flash";
+        case "mistral":
+            return "mistral-small-latest";
+        case "openai":
+        default:
+            return "gpt-4o-mini";
+    }
+}
+/**
+ * Ensure the user is authenticated. Prompts for login if needed.
+ * Returns true if authenticated, false if the user declined.
+ */
+export async function ensureAuth() {
+    if (getToken())
+        return true;
+    printInfo("You need to log in to provision cloud resources.");
+    const { shouldLogin } = await inquirer.prompt([
+        {
+            type: "confirm",
+            name: "shouldLogin",
+            message: "Log in now? (choose No to run offline with --local)",
+            default: true,
+        },
+    ]);
+    if (!shouldLogin)
+        return false;
+    const auth = await loginWithDevice();
+    return !!auth;
+}
+export async function waitForHealthy(port, endpoint = "/health", timeoutMs = 30000) {
+    const deadline = Date.now() + timeoutMs;
+    const url = `http://localhost:${port}${endpoint}`;
+    while (Date.now() < deadline) {
+        try {
+            const res = await fetch(url);
+            if (res.ok)
+                return true;
+        }
+        catch {
+            // not up yet
+        }
+        await new Promise((r) => setTimeout(r, 500));
+    }
+    return false;
+}
+//# sourceMappingURL=provisioning.js.map

package/dist/src/lib/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../../src/lib/provisioning.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAgB,MAAM,cAAc,CAAC;AACvD,OAAO,EACH,WAAW,EACX,WAAW,EACX,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,GACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,UAAU,EACV,UAAU,EACV,eAAe,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACH,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,UAAU,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAgBrD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,aAAqB;IAErB,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAExC,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1D,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAGnB,SAAS,EAAE;YACT,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACF,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxC,WAAW,EAAE,kCAAkC;gBAC/C,cAAc,EAAE,IAAI;gBACpB,mBAAmB,EAAE,IAAI;gBACzB,WAAW,EAAE,SAAS;aACzB;SACJ,CAAC,CAAC;QACH,OAAO,GAAG,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QACrB,YAAY,CAAC,OAAO,CAAC,sBAAsB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,YAAY,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAChD,MAAM,GAAG,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC;IACtD,IAAI,OAAe,CAAC;IACpB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAA+B,SAAS,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACF,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACxC,WAAW,EAAE,kCAAkC;aAClD;SACJ,CAAC,CAAC;QACH,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;QACnB,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,YAAY,CAAC,OAAO,CAAC,kBAAkB,SAAS,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,2CAA2C,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/E,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,WAAW,OAAO,EAAE,EAAE;YAC5B,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,OAAO,WAAW,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACF,cAAc,EAAE,OAAO;gBACvB,YAAY,EAAE,OAAO;gBACrB,mBAAmB,EAAE,WAAW;gBAChC,WAAW,EAAE,CAAC,MAAM,CAAC;aACxB;SACJ,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,OAAO,WAAW,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACF,cAAc,EAAE,OAAO;gBACvB,YAAY,EAAE,OAAO;gBACrB,mBAAmB,EAAE,aAAa;gBAClC,WAAW,EAAE,CAAC,MAAM,CAAC;aACxB;SACJ,CAAC,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,kEAAkE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,aAAa,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC5D,MAAM,GAAG,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACzC;YACI,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CACpB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;SACxE;KACJ,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YACxC;gBACI,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,qBAAqB;gBAC9B,IAAI,EAAE,GAAG;aACZ;SACJ,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAEzC;IACG,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,CAAC,cAAc,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,IAAI,cAAc,CAAC;IAEpD,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,UAA8B,CAAC;IAEnC,IAAI,aAAa,EAAE,CAAC;QAChB,SAAS,CAAC,qDAAqD,CAAC,CAAC;QACjE,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,WAAW,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACJ,UAAU,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACD,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CACX,kDAAkD;gBAC9C,oEAAoE;gBACpE,iFAAiF;gBACjF,kFAAkF,CACzF,CAAC;QACN,CAAC;IACL,CAAC;IAED,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACD,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACX,wBAAwB,IAAI,CAAC,IAAI,mCAAmC;oBAChE,oCAAoC,IAAI,CAAC,IAAI,EAAE,CACtD,CAAC;YACN,CAAC;YACD,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,CAAC,4CAA4C,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1E,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,UAAW,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC7C,MAAM,IAAI,KAAK,CACX,gCAAgC;gBAC5B,0CAA0C;gBAC1C,2DAA2D,CAClE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,sBAAsB,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,UAAU;YAAE,UAAU,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACrD,MAAM,IAAI,KAAK,CACX,+BAA+B;gBAC3B,0CAA0C;gBAC1C,6DAA6D;gBAC7D,+CAA+C;gBAC/C,yEAAyE,CAChF,CAAC;QACN,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACJ,SAAS,CAAC,6BAA6B,UAAU,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACpD,QAAQ,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,WAAW;YACZ,OAAO,yBAAyB,CAAC;QACrC,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACT,OAAO,kBAAkB,CAAC;QAC9B,KAAK,SAAS;YACV,OAAO,sBAAsB,CAAC;QAClC,KAAK,QAAQ,CAAC;QACd;YACI,OAAO,aAAa,CAAC;IAC7B,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC5B,IAAI,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IAE5B,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC9D,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QAC1C;YACI,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,qDAAqD;YAC9D,OAAO,EAAE,IAAI;SAChB;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,IAAY,EACZ,QAAQ,GAAG,SAAS,EACpB,SAAS,GAAG,KAAK;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,oBAAoB,IAAI,GAAG,QAAQ,EAAE,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACL,aAAa;QACjB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/src/registry.yaml

@@ -0,0 +1,62 @@
+version: 1
+templates:
+  - name: langchain
+    display_name: "LangChain / LangGraph"
+    version: 1.0.0
+    language: python
+    description: "Python agent using LangChain with 1Claw MCP for secrets and signing"
+  - name: crewai
+    display_name: "CrewAI"
+    version: 1.0.0
+    language: python
+    description: "Multi-agent crew with 1Claw-managed secrets"
+  - name: openai-agents
+    display_name: "OpenAI Agents SDK"
+    version: 1.0.0
+    language: python
+    description: "OpenAI Agents SDK with tool calling and 1Claw MCP integration"
+  - name: elizaos
+    display_name: "ElizaOS"
+    version: 1.0.0
+    language: node
+    description: "ElizaOS character runtime with vault-backed secrets"
+  - name: agentkit
+    display_name: "Coinbase AgentKit"
+    version: 1.0.0
+    language: python
+    description: "Coinbase AgentKit for onchain agents with 1Claw key management"
+  - name: smolagents
+    display_name: "HuggingFace smolagents"
+    version: 1.0.0
+    language: python
+    description: "HuggingFace lightweight agents with 1Claw secrets"
+  - name: llamaindex
+    display_name: "LlamaIndex"
+    version: 1.0.0
+    language: python
+    description: "LlamaIndex agent with tool integration and 1Claw MCP"
+  - name: pydantic-ai
+    display_name: "Pydantic AI"
+    version: 1.0.0
+    language: python
+    description: "Type-safe Python agent with structured output"
+  - name: agno
+    display_name: "Agno"
+    version: 1.0.0
+    language: python
+    description: "Agno multi-modal agent with 1Claw secrets"
+  - name: mastra
+    display_name: "Mastra"
+    version: 1.0.0
+    language: node
+    description: "TypeScript-first AI agent framework"
+  - name: typescript-sdk
+    display_name: "TypeScript SDK"
+    version: 1.0.0
+    language: node
+    description: "Plain TypeScript agent using @1claw/sdk with Shroud LLM routing"
+  - name: coder
+    display_name: "Coder"
+    version: 1.0.0
+    language: python
+    description: "Coder workspace automation agent"

package/dist/src/templates/agentkit/Dockerfile

@@ -0,0 +1,34 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+RUN pip install --no-cache-dir 1claw-mcp 2>/dev/null || \
+    (apt-get update && apt-get install -y --no-install-recommends nodejs npm && \
+     npm install -g @1claw/mcp@latest && \
+     rm -rf /var/lib/apt/lists/*) || \
+    echo "WARN: 1claw-mcp install deferred to runtime"
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=agentkit
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/src/templates/agentkit/README.md

@@ -0,0 +1,36 @@
+# Coinbase AgentKit Template
+
+A Python agent using [Coinbase AgentKit](https://github.com/coinbase/agentkit) for onchain operations with 1Claw key management.
+
+## Quick start
+
+```bash
+1claw spawn agentkit
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn agentkit --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — AgentKit-powered LangGraph agent with onchain tools
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to configure AgentKit actions (deploy tokens, transfer,
+check balances, etc.). Set CDP API credentials via the 1Claw vault for
+Coinbase Developer Platform integration.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn agentkit --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models

package/dist/src/templates/agentkit/agent.py

@@ -0,0 +1,83 @@
+"""
+Coinbase AgentKit agent pre-wired with 1Claw MCP for secrets and signing.
+
+LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+The container never sees raw API keys — they are injected by the host daemon.
+"""
+
+import os
+from flask import Flask, request, jsonify
+from langchain_openai import ChatOpenAI
+from coinbase_agentkit import AgentKit, AgentKitConfig
+from coinbase_agentkit_langchain import get_langchain_tools
+from langgraph.prebuilt import create_react_agent
+
+app = Flask(__name__)
+
+SHROUD_URL = os.environ.get("ONECLAW_SHROUD_URL", "https://shroud.1claw.xyz")
+LLM_VIA_SHROUD = os.environ.get("ONECLAW_LLM_VIA_SHROUD", "").lower() == "true"
+MODEL = os.environ.get("ONECLAW_SHROUD_MODEL", "gpt-4o-mini")
+
+
+def create_agent():
+    """Build an AgentKit-powered LangGraph agent. Returns None if no LLM."""
+    if not LLM_VIA_SHROUD:
+        return None
+
+    llm = ChatOpenAI(
+        model=MODEL,
+        base_url=f"{SHROUD_URL}/v1",
+        api_key="shroud-injected",
+    )
+
+    agentkit = AgentKit(AgentKitConfig())
+    tools = get_langchain_tools(agentkit)
+    return create_react_agent(llm, tools=tools)
+
+
+agent_executor = create_agent()
+
+
+@app.route("/health")
+def health():
+    return jsonify({"status": "ok", "framework": "agentkit", "llm_wired": LLM_VIA_SHROUD})
+
+
+@app.route("/chat", methods=["POST"])
+def chat():
+    data = request.get_json(silent=True) or {}
+    message = data.get("message", "").strip()
+    if not message:
+        return jsonify({"error": "No message provided"}), 400
+
+    if not agent_executor:
+        return jsonify({
+            "response": "No LLM configured. Use --llm-api-key or enable Token Billing.",
+            "framework": "agentkit",
+        })
+
+    try:
+        result = agent_executor.invoke({"messages": [{"role": "user", "content": message}]})
+        output = result["messages"][-1].content if result.get("messages") else str(result)
+        return jsonify({"response": output, "framework": "agentkit"})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.route("/")
+def index():
+    return """<!DOCTYPE html>
+<html><head><title>1Claw AgentKit Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw Coinbase AgentKit</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>"""
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    print(f"AgentKit agent listening on http://0.0.0.0:{port}")
+    app.run(host="0.0.0.0", port=port)

package/dist/src/templates/agentkit/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw AgentKit Agent"
+echo "   Framework: agentkit"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/src/templates/agentkit/requirements.txt

@@ -0,0 +1,5 @@
+coinbase-agentkit>=0.2.0
+coinbase-agentkit-langchain>=0.2.0
+langchain-openai>=0.2.0
+langgraph>=0.2.0
+flask>=3.0.0

package/dist/src/templates/agentkit/template.yaml

@@ -0,0 +1,24 @@
+name: agentkit
+display_name: "Coinbase AgentKit"
+version: 1.0.0
+description: "Coinbase AgentKit for onchain agents with 1Claw key management"
+author: 1Claw
+language: python
+homepage: https://github.com/coinbase/agentkit
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: agentkit
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to customize your AgentKit agent's onchain capabilities.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.